CVE & CISA-KEV Catalog

CVE-2017-17742

MEDIUMEPSS 92th pctl
5.3
CVSS v3
NVD

Description

Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick.

CWE-113

How to fix

Remediation Available
jrubyDebian
Fixed in:9.3.9.0+ds-1CVE-2017-17742
Fixed in:9.3.9.0+ds-1CVE-2017-17742
Fixed in:9.3.9.0+ds-1CVE-2017-17742
libruby1.9.1Ubuntu
Fixed in:1.9.3.484-2ubuntu1.12USN-3685-1
libruby2.0Ubuntu
Fixed in:2.0.0.484-1ubuntu2.10USN-3685-1
libruby2.3Ubuntu
Fixed in:2.3.1-2~16.04.10USN-3685-1
ruby1.9.1Ubuntu
Fixed in:1.9.3.484-2ubuntu1.12USN-3685-1
ruby1.9.3Ubuntu
Fixed in:1.9.3.484-2ubuntu1.12USN-3685-1
ruby2.0Ubuntu
Fixed in:2.0.0.484-1ubuntu2.10USN-3685-1
ruby2.3Ubuntu
Fixed in:2.3.1-2~16.04.10USN-3685-1
Ruby 3.0Windows application
Affected:2.4.0 2.4.4Fixed in:2.4.4RubyInstaller Team
Affected:2.2.0 2.2.10Fixed in:2.2.10RubyInstaller Team
Affected:2.3.0 2.3.7Fixed in:2.3.7RubyInstaller Team
Affected:2.5.0 2.5.1Fixed in:2.5.1RubyInstaller Team
Ruby 3.1Windows application
Affected:2.4.0 2.4.4Fixed in:2.4.4RubyInstaller Team
Affected:2.2.0 2.2.10Fixed in:2.2.10RubyInstaller Team
Affected:2.3.0 2.3.7Fixed in:2.3.7RubyInstaller Team
Affected:2.5.0 2.5.1Fixed in:2.5.1RubyInstaller Team
Ruby 3.2Windows application
Affected:2.5.0 2.5.1Fixed in:2.5.1RubyInstaller Team
Affected:2.3.0 2.3.7Fixed in:2.3.7RubyInstaller Team
Affected:2.2.0 2.2.10Fixed in:2.2.10RubyInstaller Team
Affected:2.4.0 2.4.4Fixed in:2.4.4RubyInstaller Team
Ruby 3.2 with MSYS2Windows application
Affected:2.2.0 2.2.10Fixed in:2.2.10RubyInstaller Team
Affected:2.4.0 2.4.4Fixed in:2.4.4RubyInstaller Team
Affected:2.5.0 2.5.1Fixed in:2.5.1RubyInstaller Team
Affected:2.3.0 2.3.7Fixed in:2.3.7RubyInstaller Team
Ruby 3.3Windows application
Affected:2.2.0 2.2.10Fixed in:2.2.10RubyInstaller Team
Affected:2.4.0 2.4.4Fixed in:2.4.4RubyInstaller Team
Affected:2.3.0 2.3.7Fixed in:2.3.7RubyInstaller Team
Affected:2.5.0 2.5.1Fixed in:2.5.1RubyInstaller Team
Ruby 3.3 with MSYS2Windows application
Affected:2.2.0 2.2.10Fixed in:2.2.10RubyInstaller Team
Affected:2.5.0 2.5.1Fixed in:2.5.1RubyInstaller Team
Affected:2.4.0 2.4.4Fixed in:2.4.4RubyInstaller Team
Affected:2.3.0 2.3.7Fixed in:2.3.7RubyInstaller Team

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged

Impact

ConfidentialityNone
IntegrityLow
AvailabilityNone

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploit Intelligence

5.76%probability of exploitation in 30 days
92ndpercentile

High risk: more likely to be exploited than 92% of all known CVEs.

References

Vendor Advisory1
Embed a live status badge for CVE-2017-17742
CVE-2017-17742 severity badge

Markdown

[![CVE-2017-17742](https://tridentstack.com/cve/badge/CVE-2017-17742.svg)](https://tridentstack.com/cve/CVE-2017-17742)

HTML

<a href="https://tridentstack.com/cve/CVE-2017-17742"><img src="https://tridentstack.com/cve/badge/CVE-2017-17742.svg" alt="CVE-2017-17742"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2024-11-21.